IGP Compliance & Risk Management 2

Question 1

Under the NIST Risk Management Framework (RMF), which step involves continuously tracking security controls over time?

Accepted Answer

Monitor

Answer

The Monitor step in the NIST RMF involves ongoing assessment of security controls to detect changes that may affect risk posture.

Question 2

A company discovers that a third-party vendor has been improperly handling customer PII. Under a risk management framework, this is best classified as:

Accepted Answer

Third-party/supply chain risk

Answer

Risks arising from vendor or supplier relationships are classified as third-party or supply chain risk in standard risk frameworks.

Question 3

Which compliance framework is specifically designed to protect cardholder data for organizations that process credit card transactions?

Accepted Answer

PCI DSS

Answer

PCI DSS (Payment Card Industry Data Security Standard) mandates security controls for any organization that stores, processes, or transmits cardholder data.

Question 4

In risk management, the term 'residual risk' refers to:

Accepted Answer

Risk remaining after controls have been applied

Answer

Residual risk is the level of risk that remains after risk treatment or controls have been implemented.

Question 5

The Sarbanes-Oxley Act (SOX) Section 302 primarily requires:

Accepted Answer

CEO and CFO certification of financial statement accuracy

Answer

SOX Section 302 requires senior executives to personally certify the accuracy and completeness of corporate financial reports.

(IGP) Information Governance Professional Practice Test

(IGP) Information Governance Professional Practice Test

IGP Compliance & Risk Management 2